CVE-2021-28958
critical · 9.8Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.
9.8
CVSS
73.1%
EPSS (exploit prob.)
99th
EPSS percentile
2021-06-25
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| zohocorp | manageengine_adselfservice_plus | 4.5 |
| zohocorp | manageengine_adselfservice_plus | 4.5 |
| zohocorp | manageengine_adselfservice_plus | 4.5 |
| zohocorp | manageengine_adselfservice_plus | 4.5 |
| zohocorp | manageengine_adselfservice_plus | 4.5 |
| zohocorp | manageengine_adselfservice_plus | 4.5 |
| zohocorp | manageengine_adselfservice_plus | 4.5 |
| zohocorp | manageengine_adselfservice_plus | 4.5 |
| zohocorp | manageengine_adselfservice_plus | 4.5 |
| zohocorp | manageengine_adselfservice_plus | 4.5 |
| zohocorp | manageengine_adselfservice_plus | 4.5 |
| zohocorp | manageengine_adselfservice_plus | 4.5 |
| zohocorp | manageengine_adselfservice_plus | 4.5 |
| zohocorp | manageengine_adselfservice_plus | 4.5 |
| zohocorp | manageengine_adselfservice_plus | 4.5 |
| zohocorp | manageengine_adselfservice_plus | 4.5 |
| zohocorp | manageengine_adselfservice_plus | 4.5 |
| zohocorp | manageengine_adselfservice_plus | 5.0 |
| zohocorp | manageengine_adselfservice_plus | 5.0 |
| zohocorp | manageengine_adselfservice_plus | 5.0 |
| zohocorp | manageengine_adselfservice_plus | 5.0 |
| zohocorp | manageengine_adselfservice_plus | 5.0 |
| zohocorp | manageengine_adselfservice_plus | 5.0 |
| zohocorp | manageengine_adselfservice_plus | 5.0 |
| zohocorp | manageengine_adselfservice_plus | 5.0 |
| zohocorp | manageengine_adselfservice_plus | 5.0 |
| zohocorp | manageengine_adselfservice_plus | 5.0 |
| zohocorp | manageengine_adselfservice_plus | 5.0 |
| zohocorp | manageengine_adselfservice_plus | 5.0 |
| zohocorp | manageengine_adselfservice_plus | 5.0.6 |
| zohocorp | manageengine_adselfservice_plus | 5.1 |
| zohocorp | manageengine_adselfservice_plus | 5.1 |
| zohocorp | manageengine_adselfservice_plus | 5.1 |
| zohocorp | manageengine_adselfservice_plus | 5.1 |
| zohocorp | manageengine_adselfservice_plus | 5.1 |
| zohocorp | manageengine_adselfservice_plus | 5.1 |
| zohocorp | manageengine_adselfservice_plus | 5.1 |
| zohocorp | manageengine_adselfservice_plus | 5.1 |
| zohocorp | manageengine_adselfservice_plus | 5.1 |
| zohocorp | manageengine_adselfservice_plus | 5.1 |
Check a specific version with /api/v1/cve/match.
References
- https://blog.stmcyber.com/vulns/cve-2021-28958/
- https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6102-released-with-an-important-security-fix-21-3-2021
- https://www.manageengine.com
- https://www.manageengine.com/products/self-service-password/release-notes.html#6102
- https://blog.stmcyber.com/vulns/cve-2021-28958/
- https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6102-released-with-an-important-security-fix-21-3-2021
- https://www.manageengine.com
- https://www.manageengine.com/products/self-service-password/release-notes.html#6102
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2021-28958